Filter data by condition on a heavy forwarder

[aalaa]

Hello ,

Please i need to filter data on the heavy forwrader to eliminate some logs ,
Exemple : i need to ingnore logs which contains the fields TYPE=PERMIT with the PROTOCOL=HTTP
it's work good to eliminate the log which contains the TYPE=PERMIT but i need to ignore just the TYPE=PERMIT with the PROTOCOL=HTTPS

transforms.conf

[setnull]
REGEX = >PERMIT<
DEST_KEY = queue
FORMAT = nullQueue

[somesoni2]

Your REGEX should search for both fields, so it necessary to know in which order they appear in your raw data and if your data is multiline. If it's single line and TYPE=PERMIT comes before PROTOCOL=HTTPS, then you could do REGEX = \>PERMIT\<.+\>HTTPS\< but again, more accurate answers can be given if you share some sample data.

[harsmarvania57]

Can you please post some sample events (Mask sensitive data) ?